In its statement: “The malware searched only for track data read from a payment card as it was being routed through the POS device. In most instances, the malware only found track data that did not have cardholder name – only card number, expiration date, and internal verification code – but occasionally the cardholder name was found.”

Forever 21 has more than 800 stores in over 57 countries. The retailer noted that although stores outside the U.S. use different payment processing systems, they are still determining if these stores were also affected. Forever 21 said that the malware and ensuing breach did not affect payment cards used on their website.

PoS malware, as exemplified by the likes of AbaddonPOS, RawPOS, and MajikPOS, are often combined with other threats to maximize the data they can steal, such as backdoors and keyloggers. The stolen information can range from driver’s licenses, credentials and other personally identifiable information (PII).

Stolen payment data typically wind up being traded on the cybercriminal underground for up to US$700. The Chinese underground, for instance, offers related wares such as hardware skimmers that extract data from PoS devices and automated teller machines (ATMs).

Businesses stand to lose more than just revenue in data breaches. Losing customer trust and credibility is just as significant. For instance, the General Data Protection Regulation (GDPR) that will be implemented in May 2018 will fine businesses up to 20 million euros (US$24 million) for failing to protect customer data.

Here are some of the countermeasures that businesses can implement to mitigate these threats:

Properly securing other points of entry, such as remote desktops and endpoints

Deploying application control/whitelisting and behavior monitoring, which detect and block unknown files and prevent anomalous modifications or routines from running

Proactively monitoring the network for any red flags, such as suspicious data exfiltration

In its statement, Forever 21 said it is working with payment processors, PoS device providers, and third-party cyber forensics experts to improve its security posture. Forever 21 is also providing free credit monitoring services to customers who may be affected and advises customers to report fraud to the authorities.

2019 SECURITY PREDICTIONS

Our security predictions for 2019 are based on our experts’ analysis of the progress of current and emerging technologies, user behavior, and market trends, and their impact on the threat landscape.View the 2019 Security Predictions